AI coding tools / security
Claude Code 2.1.251 Patches Out-of-Bounds Reads and Writes via Symbolic Links and Adds Model-Switch Hooks
Following the restricted mode introduced in 2.1.248, Anthropic has patched five more categories of trust-boundary issues involving files, plugins, and settings. The new release also exposes model-switch hooks and prompt cache metrics, allowing enterprise gateways to intercept switches and track recaching costs.
The focus of Claude Code 2.1.251 is not routine reliability fixes, but tighter trust boundaries between the agent’s local filesystem access and configuration layers. The most direct issue is a classic time-of-check-to-time-of-use race: after Read, Write, or Edit completed a permission check, replacing a symbolic link in the working directory could previously cause the tool to follow the new target and read or write files outside the approved scope. The new version blocks this out-of-bounds path. Grep and Glob now also apply `Read(...)` deny rules to files discovered through symbolic links.
Other fixes cover command paths declared by plugin marketplaces: paths pointing outside the plugin directory are now treated as path traversal. The Workflow tool also no longer reads an unauthorized `scriptPath` before checking permissions or references it in error messages. Project-level settings can no longer enable verbose beta tracing or raw API body logging, or bypass an OTLP collector pinned by managed settings. These changes are especially important for teams that automatically install plugins, process untrusted repositories, or run Claude Code in CI.
On the feature side, new `PreModelSwitch` and `PostModelSwitch` hooks can block model switches, require confirmation, or attach annotations. The `SessionStart` resume hook now also receives the session’s staleness and estimated recaching cost. `/cost` adds per-session cache hits, misses, recached tokens, and cold/warm status, providing the observability needed when switching models causes the entire conversation to be recomputed.
However, the release notes provide no CVE identifiers, attack prerequisites, affected-version range, or proof of exploitation, so not every fix should be treated as a vulnerability known to have been exploited in practice. Engineering teams should still upgrade and rerun tests for symbolic links, plugin paths, and managed settings. Restricted mode is also only a tool-layer control; it cannot replace containers, operating-system permissions, or secrets isolation.